CWE-755

{
  "affected": [],
  "aliases": [
    "CVE-2022-32590"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-07T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In wlan, there is a possible use after free due to an incorrect status check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07299425; Issue ID: ALPS07299425.",
  "id": "GHSA-5fhf-cvqm-hg98",
  "modified": "2022-10-12T19:00:40Z",
  "published": "2022-10-08T00:00:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32590"
    },
    {
      "type": "WEB",
      "url": "https://corp.mediatek.com/product-security-bulletin/October-2022"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "simplesamlphp/simplesamlphp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2011-4625"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-12T23:10:19Z",
    "nvd_published_at": "2019-11-06T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.",
  "id": "GHSA-5fj7-f8x3-q2mc",
  "modified": "2024-01-12T23:10:19Z",
  "published": "2022-04-22T00:24:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4625"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/simplesamlphp/simplesamlphp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/simplesamlphp/simplesamlphp/blob/b3059c51a915910c6631fb2ee597c0fb6ad9162b/docs/simplesamlphp-changelog-1.x.md?plain=1#L1624"
    },
    {
      "type": "WEB",
      "url": "https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202330-1"
    },
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2011-4625"
    },
    {
      "type": "WEB",
      "url": "https://www.mageni.net/vulnerability/debian-security-advisory-dsa-2330-1-simplesamlphp-70545"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "simpleSAMLphp incorrectly handles XML encryption"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-0108"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-08T17:15:18Z",
    "severity": "HIGH"
  },
  "details": "NVIDIA Jetson Linux contains a vulnerability in NvGPU where error handling paths in GPU MMU mapping code fail to clean up a failed mapping attempt. A successful exploit of this vulnerability may lead to denial of service, code execution, and escalation of privileges.",
  "id": "GHSA-5gj6-wwjq-frjh",
  "modified": "2024-08-08T18:31:20Z",
  "published": "2024-08-08T18:31:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0108"
    },
    {
      "type": "WEB",
      "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5555"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-20678"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-413",
      "CWE-755"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-15T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the AppNav-XE feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to the incorrect handling of certain TCP segments. An attacker could exploit this vulnerability by sending a stream of crafted TCP traffic at a high rate through an interface of an affected device. That interface would need to have AppNav interception enabled. A successful exploit could allow the attacker to cause the device to reload.",
  "id": "GHSA-5gpx-8gpr-wpj2",
  "modified": "2022-04-26T00:01:02Z",
  "published": "2022-04-16T00:00:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20678"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appnav-xe-dos-j5MXTR4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-30724"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-07T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionCompleted function of Bluetooth prior to SMR Jun-2022 Release 1 leaks MAC address of the connected Bluetooth device.",
  "id": "GHSA-5jvh-86q2-frfq",
  "modified": "2022-06-12T00:00:47Z",
  "published": "2022-06-08T00:00:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30724"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2022\u0026month=6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-9009"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-755"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-09-17T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash.",
  "id": "GHSA-5q4m-ggr9-2rqh",
  "modified": "2024-04-04T01:58:03Z",
  "published": "2022-05-24T16:56:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9009"
    },
    {
      "type": "WEB",
      "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=12941\u0026token=50fabe3870c7bdc41701eb1799dddeec103de40c\u0026download="
    },
    {
      "type": "WEB",
      "url": "https://www.us-cert.gov/ics/advisories/icsa-19-255-05"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.15.1"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "routinator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.15.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49235"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-755",
      "CWE-776"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-12T19:06:16Z",
    "nvd_published_at": "2026-06-08T15:16:48Z",
    "severity": "HIGH"
  },
  "details": "When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes.",
  "id": "GHSA-5qf9-cf9c-hjc6",
  "modified": "2026-06-12T19:06:16Z",
  "published": "2026-06-08T15:33:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49235"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/NLnetLabs/routinator"
    },
    {
      "type": "WEB",
      "url": "https://github.com/NLnetLabs/routinator/releases/tag/v0.15.2"
    },
    {
      "type": "WEB",
      "url": "https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49235.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Routinator crashes when encountering maliciously crafted RRDP XML files"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.4.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "valibot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59952"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T16:14:31Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`valibot` 1.4.1 can throw a `TypeError` inside its `flatten()` helper when validation issues contain attacker-controlled object keys such as `toString`, `valueOf`, or `hasOwnProperty`.\n\nThe issue is reachable through normal `record()` validation. `record()` intentionally filters `__proto__`, `prototype`, and `constructor`, but it still accepts other own keys that collide with inherited `Object.prototype` properties. If the record key schema or value schema rejects such an entry, Valibot creates an issue path containing that key. Passing the resulting issues to Valibot\u0027s documented `flatten()` helper causes `flatErrors.nested[dotPath]` to resolve to the inherited method instead of an own error array, and the helper calls `.push(...)` on that function.\n\nThis is not a global prototype pollution issue. The impact is availability/error handling: applications that validate user-controlled objects with `record()` and flatten validation errors for API responses can crash the request path with a `TypeError` instead of returning structured validation errors.\n\n## Affected package\n\n- Ecosystem: npm\n- Package: `valibot`\n- Affected version verified: `1.4.1`\n- Fixed version: none known\n- Repository: `open-circle/valibot`\n- Current main ref tested by source review: `9bb6617`\n\n## Root cause\n\n`record()` uses `_isValidObjectKey()` before validating record entries. The helper blocks the three classic prototype pollution keys:\n\n```ts\nkey !== \u0027__proto__\u0027 \u0026\u0026\nkey !== \u0027prototype\u0027 \u0026\u0026\nkey !== \u0027constructor\u0027\n```\n\nIt does not block other inherited `Object.prototype` names such as `toString`, `valueOf`, and `hasOwnProperty`. These remain valid own JSON object keys and can appear in issue paths when either the record key schema or value schema rejects the entry.\n\n`flatten()` then creates nested error storage with an ordinary object:\n\n```ts\nflatErrors.nested = {};\n```\n\nFor a dot path such as `toString`, this check reads the inherited `Object.prototype.toString` function:\n\n```ts\nif (flatErrors.nested![dotPath]) {\n  flatErrors.nested![dotPath]!.push(issue.message);\n}\n```\n\nBecause the inherited function is truthy, `flatten()` calls `.push(...)` on a function and throws `TypeError: flatErrors.nested[dotPath].push is not a function`.\n\n## Impact\n\nA remote attacker can trigger this if an application:\n\n1. validates attacker-controlled JSON objects with `v.record(...)`;\n2. receives an invalid key or invalid value under a key such as `toString`;\n3. uses Valibot\u0027s `flatten(result.issues)` helper to prepare validation errors.\n\nThis is a common pattern in API/form validation: `safeParse()` collects issues and `flatten()` converts them into response-friendly error objects. Instead of a validation response, the request can hit an unexpected exception path.\n\nThe same root cause can also affect manually constructed issues or other schemas that place inherited Object property names into dot paths. I am reporting the `record()` path because it uses only public Valibot APIs and attacker-controlled JSON keys.\n\n## Local reproduction\n\nRun in a disposable directory:\n\n```bash\nnpm install valibot@1.4.1\nnode poc_record_flatten_inherited_key_dos.mjs\n```\n\nMinimal example:\n\n```js\nimport * as v from \u0027valibot\u0027;\n\nconst schema = v.record(v.string(), v.number());\nconst input = JSON.parse(\u0027{\"toString\":\"not-a-number\"}\u0027);\n\nconst result = v.safeParse(schema, input);\nconsole.log(result.success); // false\nconsole.log(result.issues[0].path.map((item) =\u003e item.key)); // [\"toString\"]\n\nv.flatten(result.issues); // TypeError\n```\n\nObserved output from `valibot@1.4.1`:\n\n```json\n{\n  \"name\": \"record value schema rejects attacker-controlled value\",\n  \"key\": \"toString\",\n  \"success\": false,\n  \"issueCount\": 1,\n  \"firstPath\": [\"toString\"],\n  \"firstMessage\": \"Invalid type: Expected number but received \\\"not-a-number\\\"\",\n  \"flattened\": {\n    \"ok\": false,\n    \"exception\": \"TypeError\",\n    \"message\": \"flatErrors.nested[dotPath].push is not a function\"\n  }\n}\n```\n\nThe local PoC also reproduces the same exception for `valueOf`, `hasOwnProperty`, `isPrototypeOf`, `propertyIsEnumerable`, and `toLocaleString`. A control case with an ordinary key produces normal flattened errors.\n\n## Duplicate checks performed before submission\n\n- npm metadata confirmed current `valibot` release is `1.4.1` and maps to `open-circle/valibot`.\n- `gh api repos/open-circle/valibot/private-vulnerability-reporting` returned `{\"enabled\":true}`.\n- `npm audit` for a clean project containing only `valibot@1.4.1` returned no vulnerabilities.\n- Repository advisories and the GitHub Advisory Database only returned the historical emoji ReDoS advisory fixed in `1.2.0`.\n- OSV exact-version query for npm `valibot` `1.4.1` returned no vulnerabilities.\n- Public issue/PR searches for `flatten toString`, `flatten hasOwnProperty`, `record toString`, `__proto__`, `constructor`, and `prototype pollution` did not find a matching disclosure of this `record()` issue-path / `flatten()` exception.\n- Reviewed related public PRs: `open-circle/valibot#67` added prototype pollution mitigation for `record()` by blacklisting `__proto__`, `prototype`, and `constructor`; it does not cover `flatten()` collisions with other inherited property names. `open-circle/valibot#1429` is an open plain-object / `record()` type semantics PR and does not disclose this `flatten()` exception behavior.\n\n## Suggested remediation\n\nUse null-prototype containers for flat error maps and/or perform own-property checks before appending:\n\n- Initialize `flatErrors.nested` as `Object.create(null)`.\n- Check nested entries with `Object.prototype.hasOwnProperty.call(flatErrors.nested, dotPath)` rather than truthiness.\n- Consider filtering or escaping unsafe dot path segments in `getDotPath()` / `flatten()`, including inherited Object property names.\n- Add regression tests for `flatten()` with paths `toString`, `valueOf`, `hasOwnProperty`, `__proto__`, `prototype`, and `constructor`.\n- Consider using the same hardening for other accumulator objects that store attacker-controlled keys.",
  "id": "GHSA-5qjj-4xww-7phc",
  "modified": "2026-07-24T16:14:31Z",
  "published": "2026-07-24T16:14:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-circle/valibot/security/advisories/GHSA-5qjj-4xww-7phc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-circle/valibot/pull/1522"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-circle/valibot/commit/1bd01c304657cd0809cc92694360b6cc60f700bf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-circle/valibot"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-circle/valibot/releases/tag/v1.4.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Valibot: record() issue paths can make flatten() throw for inherited Object property names"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-34633"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-18T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted sfence.vma instructions rather create an exception.",
  "id": "GHSA-5qrg-8qvc-xjrw",
  "modified": "2022-07-27T00:00:34Z",
  "published": "2022-07-19T00:00:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34633"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openhwgroup/cva6/issues/876"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openhwgroup/cva6/pull/921"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "comrak"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.17.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-28631"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-28T14:45:28Z",
    "nvd_published_at": "2023-03-28T21:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nA Comrak AST can be constructed manually by a program instead of parsing a Markdown document with `parse_document`. This AST can then be converted to HTML via `html::format_document_with_plugins`. However, the HTML formatting code assumes that the AST is well-formed. For example, many AST notes contain `[u8]` fields which the formatting code assumes is valid UTF-8 data. Several bugs can be triggered if this is not the case.\n\n### Patches\n\n0.17.0 contains adjustments to the AST, storing strings instead of unvalidated byte arrays.\n\n### Workarounds\n\n* Validate UTF-8 correctness of all data when assigning to `\u0026[u8]` and `Vec\u003cu8\u003e` fields in the AST.\n\n### References\nn/a",
  "id": "GHSA-5r3x-p7xx-x6q5",
  "modified": "2023-03-28T23:08:47Z",
  "published": "2023-03-28T14:45:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kivikakk/comrak/security/advisories/GHSA-5r3x-p7xx-x6q5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28631"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kivikakk/comrak/commit/9ff5f8df0ac951f5742d22a72c39b89a15f56639"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kivikakk/comrak"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kivikakk/comrak/releases/tag/0.17.0"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUYME2VA555X6567H7ORIJQFN4BVGT6N"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PTWZWCT7KCX2KTXTLPUYZ3EHOONG4X46"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VQ3UBC7LE4VPCMZBTADIBL353CH7CPVV"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Comrak AST node data is not validated (GHSL-2023-049)"
}